NSA contracted RSA to use flawed algorithm, leaks reveal

A secret contract reportedly tied the NSA and security firm RSA.

Leaked classified documents, detailed in a Friday Reuters article, show that the National Security Agency (NSA) arranged a $10 million deal with RSA that ultimately led to the security firm using a “flawed” encryption formula in its products.

According to Reuters, the contract set an “NSA formula as the preferred, or default, method for number generation in the BSAFE software.”

The algorithm in question was Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG), which both RSA and the National Institute of Standards and Technology (NIST) recommended the industry not use at the time.

Reuters reported that while the $10 million deal “might seem paltry” for a major company such as RSA – which serves as the security division for the global data storage corporation EMC – it actually accounted for “more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year."

Dual_EC_DRBG was adopted by RSA before NIST's approval, and to help spur NIST's endorsement of its use, NSA shared that the government had already used the algorithm for some time, Reuters revealed.

“RSA's contract made Dual Elliptic Curve the default option for producing random numbers in the RSA toolkit,” the article said. “No alarms were raised, former [RSA] employees said, because the deal was handled by business leaders rather than pure technologists.”

Techscape is SC Media’s content marketing platform. Industry experts share their views in the following categories

Partner Content is sponsored content brought to you by a vendor

SC Media arms cybersecurity professionals with the in-depth, unbiased business and technical information they need to tackle the countless security challenges they face and establish risk management and compliance postures that underpin overall business strategies.